Privacy Policy

Last updated 2 October 2026

ClinnIQ is practice-management software for Australian allied-health practices. This policy explains how we handle personal information, including health information, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy covers

Practices and their staff who sign up for and use ClinnIQ.

Clients and participants of those practices. Your practice decides what information about you goes into ClinnIQ and why. We store and process that information for the practice, on its instructions. If you are a client, contact your practice first about your records. It is responsible for collecting your information and for giving you access to it. You can also contact us.

Visitors to this website.

2. What we collect

• Account information: names, email addresses, phone numbers, roles, practice details (such as ABN and NDIS registration number) and billing details.
• Client records entered by practices: contact details, dates of birth, NDIS, Medicare and DVA details, funding and plan information, referrals, appointments, clinical notes, assessments, reports, documents, invoices and messages.
• Session audio and transcripts: recorded only when a clinician chooses to use dictation or AI note features.
• Communications: SMS, email, WhatsApp messages, voicemail and call recordings or transcripts that pass through ClinnIQ.
• Technical information: sign-in events, audit logs of actions in the app, IP addresses and error reports.

3. How we use it

We use personal information to provide ClinnIQ: running the practice’s scheduling, records, messaging, billing and claiming; producing AI-assisted drafts when the practice turns those features on; keeping the service secure; providing support; and meeting our legal obligations. We do not sell personal information, and we do not use client records for advertising.

4. Where your information is stored

The ClinnIQ database, file storage and application servers are in Sydney, Australia. Clinical records are stored there.

A nightly backup copy is kept in Google Drive, which may store it outside Australia. Each backup is encrypted before it leaves our servers, and only ClinnIQ holds the key to decrypt it; Google cannot read it. Backups are deleted after 30 days.

5. Overseas processing

Some features rely on service providers that process information outside Australia. In particular, session audio is sent to OpenAI or Deepgram for transcription, and AI-drafted notes are generated by Google Gemini (or another AI provider the practice selects). These providers process the content to return a result to ClinnIQ. The practice’s records are stored in Sydney.

AI features ask the clinician to confirm that consent has been obtained before they are used for a client. Practices can use ClinnIQ without AI features.

We choose providers with security commitments suited to the information involved, and we send them only what a feature needs.

6. Who else we disclose information to

Apart from the service providers above, we disclose personal information only:

• To the practice and the users it authorises, based on their roles.
• To government agencies, through the practice. ClinnIQ prepares NDIS claim files that contain participant and support details. The practice lodges them with the NDIA itself; ClinnIQ does not send claims to government agencies directly.
• Where the law requires or authorises it, for example under a court order.

7. AI-generated content

AI output in ClinnIQ is a draft. A clinician must review and confirm it before it is saved to a client’s record. The practice stays responsible for the clinical content it keeps.

8. Security

Information is encrypted in transit and at rest. Each practice’s data is kept separate at the database level. Access depends on each user’s role, and multi-factor authentication is available. Key actions on client records are written to an audit log that users cannot edit or delete. No system is completely secure, but we take reasonable steps to protect information from misuse, loss, and unauthorised access or disclosure.

9. Data breaches

If we become aware of a data breach likely to cause serious harm, we will tell the affected practices promptly. We will meet our obligations under the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals where required.

10. Retention and deletion

We keep a practice’s information while its account is active. Practices must keep health records for the periods set by law, so a practice can export its data before closing its account. After that, we delete or de-identify it within a reasonable time, unless the law requires us to keep it.

11. Access, correction and complaints

You can ask to see or correct personal information we hold about you. Email hello@clinniq.com.au. If the information belongs to a practice’s client record, we will work with that practice to respond. We aim to reply within 30 days.

If you have a privacy complaint, email us first. If our response doesn’t resolve it, you can complain to the OAIC at oaic.gov.au.

12. Cookies

ClinnIQ uses cookies only to keep you signed in and to secure access to the participant portal. We do not use advertising or third-party analytics cookies.

13. Changes to this policy

We will update this page when our practices or providers change. We will notify practices of significant changes.

Contact

ClinnIQ · hello@clinniq.com.au